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Amendment and Response to February 8, 2007 Office Action 

AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions* and listings, of claims in the 
application: 

1 . (Currently Amended) A computer-implemented method for managing risk 
related to a security risk event, the method comprising: 

receiving information relating to a particular security risk event; 

automatically processing, by a computer, the information received to associate 
the received information with a first set of risk variables related to the particular security 
risk event; 

defining a second set of risk variables related to the particular security risk event, 
wherein the first set of risk variables and the second set of risk variables are different; 

manualiv associating, in an instance the received infonmation cannot be 
automaticallv processed to associate the received infonmatton with the first set of risk 
variables, the first set of risk variables with the received Information that cannot be 
automaticallv processed: 

associating a portion of the received infonnation related to the particular security 
risk event and not associated with the first set of risk variables with the second set of 
risk variables; and 

calculating a security level using the processed information and a set of 
relationships established between the first set and second set of risk variable s: and 

automaticallv executino an action in resoonse to said securitv level exceedina a 
predetermined threshold . 
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2. (Previously Presented) The method of claim 1 wherein the security 
level comprises an indication of an amount of risk that a breach of security may occur 
relating to the particular security risk event. 

3. (Previously Presented) The method of claim 1 wherein the security 
level comprises a security confidence level indicative of how secure a particular facility 
can be made relative to the particular security risk event. 

4. (Previously Presented) The method of claim 1 wherein the security 
level comprises a security confidence level of how secure a particular practice can be 
made relative to the particular security risk event. 

5. (Previously Presented) The method of claim 1 wherein the security 
level comprises a security maintenance level indicative of a level of security that should 
be maintained in relation to the particular security risk event. 

6. (Previously Presented) The method of claim 1 additionally comprising 
the step of: 

generating a suggested security measure according to the security level and 
processed infomiation. 

7. (Original) The method of claim 6 additionally comprising the step of: 

storing the Information received, the security level and the suggested security 
measure. 

8. (Original) The method of claim 6 additfonatly comprising the step of: 
receiving information relating to security measures executed; and 
generating a security diligence report. 
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9. (Previously Presented) The method of claim 8 wherein the security 
diligence report comprises inquiries made relating to the particular security risk event 
and security measures executed responsive to the security level. 

10. (Previously Presented) The method of claim 6 wherein the suggested 
security measure comprises physical protection of media containing information relating 
to the particular security risk event. 

1 1 . (Previously Presented) The method of claim 6, wherein the suggested 
security measure comprises physical protection of a facility associated with the 
particular security risk event. 

12. (Previously Presented) The method of claim 6, wherein the wherein 
the suggested security measure comprises physical protection of a building associated 
with a business transaction. 

13. (Previously Presented) The method of claim 6, wherein the suggested 
security measure comprises notifying an authority regarding a potential breach of 
security. 

14. (Original) The method of claim 6 additionally comprising the step of: 

branding the suggested security measure according to the set of relationships 
between the risk variat)les. 

1 5. (Original) The method of claim 1 wherein level of analysis utilized in 
the calculation of the security level is rated according to a classification. 

16. (Previously Presented) The method of claim 1 wherein the calculation 
comprises a level of weighting associated with a category of risk variables. 

17. ( Previously Presented) The method of claim 1 wherein the calculation 
comprises aggregating multiple weightings of the first and second sets of risk 
variables. 
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18. (Previously Presented) The method of claim 1 wherein the calculation 
comprises a relationship algorithm that determines which of the first and second sets of 
risk variables affects others of the first and second sets of risk variables. 

19. (Cun^ently Amended) The method of claim 1 wherein the calculation 
Includes a relationship algorithm comprising how data including a first variable of 
the first and second sets of risk variables c an affect a weighting for a second 
variabl e of the first and second sets of risk variables , 

20. (Original) The method. of claim 1 additionally comprising the step of: 
recalculating the security level responsive to new infonmation received. 

21 . (Previously Presented) The method of claim 1 additionally comprising 
the step of: 

recalculating the security level responsive to progression of a chronology of 
particular security risk events. 

22. (Currently Amended) A computerized system for managing risk 
related to a particular security risk event, the system comprising: 

a computer server accessible with a system access device via a communications 
network; and 

executable software stored on the server and executable on demand, the 
software operative with the server to cause the system to: 

receive information relating to the particular security risk event; 

automatically process the infomnation received to associate the received 
information with a first set of risk variables related to the particular security risk event; 

define a second set of risk variables related to the particular security risk event, 
wherein the first set of risk variables and the second set of risk variables are different; 
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nnanuallv associate, in an instance the received information cannot be 
automatically processed to associate the received information with the first set of risk 
variables, the first set of risk variables with the received information that cannot be 
automatical! V processed: 

associate a portion of the received information related to the particular security 
risk event and not associated with the first set of risk variables with the second set of 
risk variables; and 

calculate a security level using the structured infonmation and a set of 
relationships established between the risk variables : and 

automatically execute an action In response to said securitv level exceeding a 
predetermine d threshold. 

23. (Original) The computerized system of claim 22 wherein the data is 
gathered via an electronic feed. 

24. (Currently Amended) A computer-readable mediuni having computer 
executable program instructions residing thereon, the computer-readable medium 
comprising : 

instnjctions to receive information relating to a particular security risk event; 

instructtons to automatically process the infomnatlon received to associate the 
received Informatton with a first set of risk variables related to the particular security risk 
event; 

instructions to define a second set of risk variables related to the particular 
security risk event, wherein the first set of risk variables and the second set of risk 
variables are different; 

instructions to manually associate, in an instance the received information 
cannot be automatically processed to associate the received Information with the first 
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set of risk variables, the first set of risk variables with the received information that 
cannot be automatically processed: 

instructions to associate a portion of the received infonmatlon related to the 
particular security risk event and not associated with the first set of risk variables with 
the second set of risk variables; 

instructions to calculate a security level using the structured infonmation and a 
set of relationships established between the risk variable s; and 

instructions to automatlcallv execute an action in response to said securitv level 
exceeding a oredetermined threshold, 

25 - 28. (Canceled) 
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